European cybersecurity threats grow with AI and BEC attacks - The Cryptonomist

European cybersecurity threats rose sharply in 2026, with 4.5 times more phishing emails than in 2025, according to Proofpoint's telemetry. The increase significantly outpaced the global average of 1.5 times, making Europe the most targeted region for cyber attacks.

Proofpoint's findings reveal a comprehensive picture of threats spanning email fraud, cloud account attacks, and compromises of artificial intelligence infrastructure. The company detected particularly high engagement rates in Europe, with 8.3 clicks per 100 threat emails compared to just 2.0 worldwide.

Targeted Sectors

European electronics companies received Business Email Compromise (BEC) emails at 3.4 times the regional average, with supply-chain invoice fraud being the most common pattern. In BEC attacks, criminals take over business email accounts to impersonate owners and request transfers to attacker-controlled accounts.

Hospitality, leisure and healthcare sectors faced increases in specific attack types despite an overall decline in malware across Europe. Telephone-oriented attack delivery (TOAD) rose 262% year over year, with healthcare experiencing a 257% increase in TOAD targeting and an 84% rise in malware.

Evolving Threat Actors

Russian and Chinese threat actors remained prominent in Proofpoint's findings, while groups associated with India and Pakistan expanded their focus on Western Europe. Researchers identified TA395 as among the most prolific actors and highlighted TA488's targeting of Outlook, Zimbra and other webmail providers.

These established groups continue to evolve their techniques for gaining and retaining access to European organizations. The shift by India and Pakistan-based actors toward Western Europe adds to both state-sponsored and financially motivated cyber activities in the region.

AI Infrastructure Attacks

European cybersecurity threats increasingly target AI infrastructure, with 99% of observed organizations facing cloud-based attacks. Phishing and session hijacking affected 64% of targeted organizations, while attackers focused on connectivity mechanisms including tokens and misconfigured applications.

Open-source AI technologies like Langflow and LiteLLM became prime targets, with the share of European sensors affected by attacks against these AI building blocks increasing 4.6 times between consecutive 90-day periods. More than 188,000 AI-enabled applications were linked via authentication frameworks that attackers exploited.

Post-breach activity remains common, with 72% of European victims experiencing efforts to retain access, manipulate authentication controls, access files, or abuse compromised mailboxes. This comprehensive threat landscape demonstrates the evolving sophistication of cyber attacks targeting European organizations.